CVE-2026-82399

HIGH 7.5

CoreDNS: Unauthenticated memory exhaustion in custom transports

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header. An unauthenticated client can use DNS name compression and excessive section counts to amplify allocation before the plugin chain, so plugin-level rate limiting cannot prevent concurrent requests from exhausting memory and terminating CoreDNS. The ordinary UDP and TCP listeners are not affected because they validate the header first. This issue is fixed in version 1.14.7.

CWE	CWE-770
Vendor	coredns
Product	coredns
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for coredns coredns

Be the first to know when new high vulnerabilities affecting coredns coredns are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

coredns / coredns

< 1.14.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/coredns/coredns/security/advisories/GHSA-mrg3-qvqr-jw29 github.com: https://github.com/coredns/coredns/commit/530b0a5ff2ad68cc0421f10dd93568945cc671c9 github.com: https://github.com/coredns/coredns/releases/tag/v1.14.7